Re: ucspi-tls (attn: Scott Gifford)

On Wed, 1 Jun 2005 09:30:23 -0500
Josh Trutwin <[email protected]> wrote:

Some more information:

<snip>

> exec /usr/local/bin/envdir /etc/mailfront/smtpfront \
>     /usr/local/bin/softlimit -m 40000000 \
>     /usr/local/bin/envdir /etc/relay-ctrl \
>     /usr/local/bin/relay-ctrl-chdir \
>     /usr/local/bin/sslserver -v -R -H -l 0  \
>       -c ${CONLIMIT} \
>       -x /etc/tcp.smtp.cdb \
>       0 465 \

After reading through the docs again, I noticed the -w flag to
sslserver is missing from my run file.  I added it in before the -v
and now the behavior of SSL connections with and without STARTTLS is
reversed.  The STARTTLS connection now works:

@40000000429dc9e521bb1fcc sslserver: status: 1/31
@40000000429dc9e521c66a6c sslserver: pid 27792 from 64.83.223.150
@40000000429dc9e521cb061c sslserver: ok 27792 0:192.168.0.3:465
:64.83.223.150::24096
@40000000429dc9e61d33cabc sslserver: ssl 27791 accept 
@40000000429dc9e6358024e4 smtpfront-qmail[27792]: SASL AUTH LOGIN
username=josh
@40000000429dc9e639bcb554 smtpfront-qmail[27792]: MAIL
FROM:<[email protected]> SIZE=356
@40000000429dc9e703561e4c smtpfront-qmail[27792]: RCPT
TO:<[email protected]>
@40000000429dc9e81c0a4e7c smtpfront-qmail[27792]: Accepted message qp
27795 bytes 464
@40000000429dc9e821423a94 smtpfront-qmail[27792]: bytes in: 561 bytes
out: 416
@40000000429dc9e82611e344 sslserver: warning: dropping connection,
unable to speak SSL: error:00000005:lib(0):func(0):DH lib
@40000000429dc9e8261507f4 sslserver: end 27791 status 28416
@40000000429dc9e826151f64 sslserver: status: 0/31

Still has that "unable to speak SSL" warning though.

The SSL connection without STARTTLS now fails:

@40000000429dcba6349fa43c sslserver: status: 1/31
@40000000429dcba634be867c sslserver: pid 28014 from 64.83.223.150
@40000000429dcba634c331cc sslserver: ok 28014 0:192.168.0.3:465
:64.83.223.150::31708
@40000000429dcba718f9c6a4 smtpfront-qmail[28014]:  
@40000000429dcba718fb2a1c smtpfront-qmail[28014]: 500 Not implemented.
@40000000429dcba912b11e3c smtpfront-qmail[28014]:  
@40000000429dcba912b14164 smtpfront-qmail[28014]: 500 Not implemented.
@40000000429dcba912ba9804 sslserver: ssl 28013 accept 
@40000000429dcba912bcd63c sslserver: end 28013 status 11
@40000000429dcba912bcedac sslserver: status: 0/31

Thanks,

Josh